Dominic Evans

Ah so that gives me: > Wed Sep 4 20:41:56 2019: Runtime error: error mapping the ring buffer for device /host/dev/falco0. Exiting. Presumably because the /usr/bin/falco userspace process needs to...

Yes as per the first post, the linked article called it out as an option to reduce the amount of dropped syscalls. We already enabled logging and just wanted to...

FYI we have been running for a while now with `sed -e '/RING_BUF_SIZE/s/8/96/' -i /usr/src/sysdig/driver/ppm_ringbuffer.h` which has reduced the number of dropped events, although we still see 1 or 2,...

_keeping fresh_

We've never tried out the eBPF impl as the docs seemed like they suggested the kernel module was the recommended choice. Do we still get notified of drops with eBPF...

> What does here think about making the ring buffer size configurable via a flag ? @fntlnz did anything happen with this in the end? Currently we're still just maintaining...

@Michael-F-Bryan yes it's fairly trivial to parse as it has a well-defined format https://everything.curl.dev/usingcurl/netrc There are crates available, e.g., https://docs.rs/netrc/0.4.1/netrc/struct.Netrc.html

> To add more information, with Java client, we don't have this problem. The consumer automatically reset the current offset to log end offset depends on offset.auto.reset strategy Hmm. So...

It _seems_ the only workaround for this is to manually remove `% provided` locally whilst developing, so that `sbt eclipse` adds the sourcepath values to the .classpath

Actually, as the manpages are being installed via a standalone script, I'm guessing they probably won't currently get cleaned-up during a removal? It would probably make more sense to move...